CVE-2020-25739

An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson does not honor the escape_mode parameter to escape fields as an XSS protection mechanism. To mitigate, json_dumper.rb in gon now does escaping for XSS by default without relying on MultiJson.

• CWE-79

• https://github.com/gazay/gon/commit/fe3c7b2191a992386dc9edd37de5447a4e809bc7Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/09/msg00018.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/4560-1/Third Party Advisory
• https://github.com/gazay/gon/commit/fe3c7b2191a992386dc9edd37de5447a4e809bc7Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/09/msg00018.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/4560-1/Third Party Advisory

Published

Sep 23, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-25733webTareas through 2.1 allows upload of the dangerous .exe an…7.5
• CVE-2020-25734webTareas through 2.1 allows files/Default/ Directory Listin…5.3
• CVE-2020-25735webTareas through 2.1 allows XSS in clients/editclient.php, …6.1
• CVE-2020-25736Acronis True Image 2019 update 1 through 2021 update 1 on ma…7.8
• CVE-2020-25737An elevation of privilege vulnerability exists in Hackolade …7.8
• CVE-2020-25738CyberArk Endpoint Privilege Manager (EPM) 11.1.0.173 allows …5.5
• CVE-2020-2574Vulnerability in the MySQL Client product of Oracle MySQL (c…5.9
• CVE-2020-25741fdctrl_write_data in hw/block/fdc.c in QEMU 5.0.0 has a NULL…3.2
• CVE-2020-25742pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 ha…3.2
• CVE-2020-25743hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer…3.2
• CVE-2020-25744SaferVPN before 5.0.3.3 on Windows could allow low-privilege…8.1
• CVE-2020-25746QED ResourceXpress Qubi3 devices before 1.40.9 could allow a…4.6